Threat Intelligence for Every Defender
ThreatPodium DLL Side-Loading (T1574.002) is a technique where an attacker places a malicious DLL with a specific filename into a directory that a legitimate, often signe…
Report Date: 2026-06-19
New KEVs: 0 ▼ -7 vs last weekRansomware Victims: 148 ▼ -15 vs last week
No new vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog during this reporting window. Threat intelligence sources this period reference Evil Corp. Ransomware activity is moderate with 148 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Windows Service persistence (T1543.003) allows adversaries to register a malicious executable as a Windows service so it automatically launches every time th…
Report Date: 2026-06-18
New KEVs: 0 ▼ -7 vs last weekRansomware Victims: 163 ▲ +17 vs last week
No new vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog during this reporting window. Threat intelligence sources this period reference DragonForce. Ransomware activity is moderate with 163 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Registry Run Keys and Startup Folder persistence (T1547.001) is a technique where adversaries write entries to specific Windows registry keys or drop files i…
Report Date: 2026-06-17
New KEVs: 0 ▼ -6 vs last weekRansomware Victims: 187 ▲ +44 vs last week
No new vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog during this reporting window. Threat intelligence sources this period reference DragonForce. Ransomware activity is moderate with 187 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.
Visual Basic (VB) and its derivatives — Visual Basic for Applications (VBA) and VBScript — are scripting and programming languages that adversaries abuse to …
Report Date: 2026-06-16
New KEVs: 5 ▼ -2 vs last weekRansomware Victims: 204 ▲ +72 vs last week
5 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period, of which 1 is linked to active ransomware campaigns. Widget Factory products show the strongest concentration of risk signals this week. Ransomware activity is moderate with 204 new victims posted to leak sites over the last 7 days, with Thegentlemen posting the most victims.